fix(form-data): upgrade to >=4.0.6 across pnpm workspaces (CVE-2026-12143)

Adds a pnpm override forcing form-data >=4.0.6 in all five workspaces that resolved the vulnerable transitive
  form-data@4.0.5 (CVE-2026-12143, GHSA-hmw2-7cc7-3qxx — CRLF injection via unescaped multipart field names/filenames). Override added to pnpm-workspace.yaml everywhere, and also to package.json pnpm.overrides for the workspaces whose CI pnpm version reads it (mem0-ts,
  openmemory/ui, pi-agent-plugin, openclaw). Lockfiles regenerated with each workspace's CI pnpm version; only form-data changes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
harshgupta-mem0
2026-06-18 00:21:34 +05:30
co-authored by Claude Opus 4.8
parent 158e9111cb
commit ff5b0e778b
14 changed files with 37 additions and 23 deletions
@@ -71,6 +71,7 @@
},
"pnpm": {
"overrides": {
"form-data@<4.0.6": ">=4.0.6",
"uuid@<11.1.1": ">=11.1.1",
"esbuild": ">=0.28.1"
}